Get your business ready for DCC. From Cyber Essentials and technical remediation to policies, evidence and assessment preparation, we help you get ready for independent certification. UK-based support, on site across the M4, M3 and A34 corridors when it helps.
Book a DCC readiness call · Not sure which level you need?
Start with Level 0: the MOD has asked for it by 31 December 2026
Level 0 is the floor. It is three controls from DEF STAN 05-138: a valid Cyber Essentials certificate covering the business-critical systems in scope (control 0001), UK GDPR compliance (2314), and resilient networks and systems (2500).
Where the 31 December 2026 date comes from. The MOD has asked its industry partners to achieve Level 0 by that date, with Cyber Essentials covering the applicable business-critical systems. This is a request to the supply chain; your contract determines the binding requirement. Read the MOD’s explanation.
The binding requirement on any given contract remains the Cyber Risk Profile and the Supplier Assurance Questionnaire under DEFCON 658. In practice, the December date is when MOD buyers and prime contractors will expect to see a Level 0 certificate. If you supply the MOD or a prime and hold nothing yet, Level 0 is the place to begin, whatever level your next contract eventually names.
What Level 0 asks of you, in plain terms:
- Cyber Essentials, current and covering your business-critical systems
- The other two Level 0 controls, UK GDPR compliance and resilient networks and systems, in place and evidenced
- An assessment by an approved DCC certification body, then an annual attestation and re-certification every three years
Level 0 readiness with Nerdster includes:
- Cyber Essentials review or readiness and certification, depending on where you are
- A technical gap check against the Level 0 controls; any implementation work is scoped and quoted separately
- The DCC Level 0 readiness review and a short evidence pack organised the way the certification body expects
- Coordination with your chosen approved DCC certification body and support through the assessment
Get Level 0 ready
What it costs
Prices below are for 1 to 9 people and exclude VAT. Larger organisations pay more; the DCC packages above and the pricing page show every band. Existing valid certification and completed work are taken into account, so you never pay twice for the same preparation.
| Package |
Price for 1 to 9 people |
What it covers |
| DCC Level 0 – Ready (includes Cyber Essentials) |
£2,395 + VAT, one payment |
Cyber Essentials, the UK GDPR and resilience controls prepared and evidenced, the evidence pack and the Level 0 assessment fee. Three-year certificate. |
| DCC Level 0 – Ready (you already hold Cyber Essentials) |
£1,570 + VAT, one payment |
The same readiness and certification, reusing your existing Cyber Essentials. |
| DCC Level 0 – certification only |
£574 + VAT |
Assessment and certificate for organisations that are already prepared and hold Cyber Essentials. |
| DCC Level 0 readiness only |
Typically £1,500 to £3,000 + VAT |
Gap review, evidence plan, UK GDPR and resilience controls and assessment preparation, with your own certification body. |
| DCC Level 1 – readiness and certification |
£10,733 + VAT for the three-year certificate |
Consultant-led: gap assessment against the 101 Level 1 controls, remediation guidance over up to three rounds, evidence pack, assessment and certificate. Technical fixes quoted. |
| DCC Level 0 or Level 1 – Managed |
From £1,405 or £5,676 + VAT a year on a three-year term |
Certification each year plus device monitoring, patching, training and policies. |
| Technical fixes, licences and equipment |
Quoted separately |
Identified at the gap review, with your approval before work starts. |
Get a written quote
Level 1 and above
Level 1 is where most SME suppliers first feel the difference. Its 101 controls look across the whole organisation, not just the IT estate, and cover:
- Security governance
- Policies and procedures
- Risk management
- Asset management
- User and access controls
- Endpoint security
- Patch management
- Encryption
- Email and network security
- Staff awareness
- Supplier security
- Vulnerability management
- Logging and monitoring
- Incident response
- Business continuity and recovery
Levels 2 and 3 are reserved for high and substantial risk programmes. Both require Cyber Essentials Plus, and both call for more advanced monitoring, resilience and planning. For those levels we work with your internal team and specialist certification partners to identify gaps, implement controls and prepare the organisation for assessment.
DEF STAN 05-138 and DCC: the difference
DEF STAN 05-138 Issue 4, published in May 2024, is the Ministry of Defence’s cyber security standard for its supply chain. It defines the controls for each Cyber Risk Profile: 3 at Level 0, 101 at Level 1, 139 at Level 2 and 144 at Level 3. It is the list of things you must do.
Defence Cyber Certification is the independent certification, run by IASME for the MOD, that proves you do them. Certification is carried out by an approved DCC certification body; Nerdster is not one, which is why our advice is not tied to your assessment result.
Two practical consequences:
- If a tender, contract or prime contractor requirement quotes “DEF STAN 05-138” rather than “DCC”, it is the same set of controls, and DCC certification is the recognised way to evidence them. MOD Industry Security Notice 2026/02 confirms that a valid DCC certificate at or above the level a contract requires is accepted as evidence of the DEF STAN 05-138 controls for that contract, and that a higher certificate satisfies every lower level.
- The Supplier Assurance Questionnaire, completed through the MOD’s Supplier Cyber Protection Service, still has to be submitted. DCC evidences the controls; it does not yet replace the questionnaire.
Not sure which level you need?
You do not need to decode the Defence Standard yourself. For a plain-English walk through the scheme, the MOD’s request and the kinds of business it reaches, read Defence Cyber Certification: who needs it and why.
If an MOD customer, prime contractor or procurement process has given you a Cyber Risk Profile, we review the requirement and explain what it means for your business. If you are preparing ahead of a defence opportunity, we assess your current environment against the appropriate DCC requirements.
Talk to a DCC specialist
From requirement to ready
1. Understand
We review your DCC requirement, Cyber Risk Profile and current cyber security environment. You get a clear explanation of what applies to your organisation.
2. Assess
We compare your existing security against the required controls. Already have Cyber Essentials, ISO 27001, Microsoft 365, Intune or other controls in place? We identify what can be reused and where the real gaps are.
3. Fix
We help implement what is missing. That can include policies and procedures, Microsoft 365 security, Intune and endpoint management, MFA and identity security, access controls, device configuration, patch management, EDR and malware protection, firewalls and network security, encryption, backups and recovery, logging and monitoring, and incident response.
4. Evidence
Having security controls is not enough if you cannot demonstrate them. We build an organised evidence pack showing how each control is implemented and managed.
5. Prepare
Before independent assessment, we work through outstanding issues and help your team prepare for the certification process.
6. Maintain
Cyber compliance is not a once-a-year scramble. Nerdster can continue managing your IT, cyber security, monitoring, policies and evidence so your environment stays ready for the annual attestation.
Already have Cyber Essentials?
Good. You already hold part of the foundation, and at Level 0 most of it. Above that, DCC asks about how the whole business runs its security: who owns risk, how suppliers are vetted, what happens when something goes wrong. Nerdster helps bridge that gap.
- Cyber Essentials. Basic technical cyber hygiene. See our Cyber Essentials packages.
- DCC readiness. Technology, people, processes, policies, evidence and resilience.
- Independent DCC assessment. Assessment and certification through an approved DCC certification body licensed by IASME.
What you get
- DCC gap assessment. A structured review against the controls applicable to your required DCC level.
- Readiness score. Where you are today, what is already covered and what still needs attention.
- Remediation plan. A prioritised action plan instead of a 100-page compliance document nobody understands.
- Technical implementation. Where required, Nerdster implements and manages the underlying security technology.
- Policies and procedures. The governance and operating procedures the controls call for.
- Evidence pack. Evidence organised against the relevant controls, ready for assessment preparation.
- Certification support. We work alongside your chosen independent DCC certification body through the certification process.
- Ongoing management. Your security controls kept maintained after certification.
Already using Microsoft 365?
You may be closer than you think. For many SMEs, capabilities already available within Microsoft 365, Entra and Intune contribute to identity, MFA, device management, access control, security configuration, endpoint protection, logging and data protection.
The challenge is configuring them correctly, documenting them and filling the gaps around them. That is where Nerdster comes in. See our Microsoft 365 support.
Renewal and ongoing obligations
Certification is not the end of it. Plan for these from the start:
- DCC certificates last three years, with an annual attestation in between to confirm the controls are still in place.
- A new Supplier Assurance Questionnaire is due every year on the anniversary of the contract award, with one month to complete it. On existing contracts the MOD sends your updated Cyber Risk Profile and Risk Assessment Reference beforehand, which can change the level you need; if it has not arrived, ask your buyer.
- Cyber Essentials renews every 12 months and must stay valid throughout. Levels 2 and 3 need a valid Cyber Essentials Plus for the whole certification period.
- New and renewed MOD contracts carry the requirement. Cyber Security Model version 4 went live in October 2025 and has applied to new risk assessments and questionnaires since 3 December 2025, so a renewal is where most suppliers first meet it.
Nerdster’s optional managed service keeps the controls maintained so each of these is routine rather than a project.
Official sources
Built for SMEs in the defence supply chain
You should not need a full-time compliance department just to understand what your MOD customer is asking for. Nerdster combines IT, cyber security and practical compliance implementation into one service, and focuses on getting the controls working in the real business, not on producing policies for a folder.
- We implement the changes ourselves rather than handing you a list of what is wrong.
- You always know what is complete, what is missing and what happens next.
- If you want, we keep running the underlying security controls after the project finishes.
- Support comes from a UK technology and cyber security team.
Do not wait for a defence opportunity to expose the gaps
Whether you have already been given a DCC requirement or simply want to become ready to supply the defence sector, we will show you where you stand and what needs to happen next. Start with a DCC readiness review: understand your current position, identify the gaps and build a clear route to certification.
Book your DCC readiness call
